Cross-client VRAM access via page-alignment overflow

Integer overflow in the Linux kernel Xe driver 6.8 through 6.9.7 allows local users to read or write other clients' VRAM. In xe_ttm_vram_mgr_new(), a 32-bit left shift of tbo->page_alignment truncates min_page_size, allowing under-aligned GPU page-table mappings into neighboring buffer objects. An ordinary account with access to a /dev/dri/renderD* node can issue the deterministic buffer-creation ioctl without user interaction, and zero truncation can also panic the kernel or hang and reset the GPU.